AI agents are shipping fast. Infrastructure is not keeping up.

Over the past 48 hours, we ran comprehensive audits on 7 AI agent sites and set up continuous monitoring on 10 more. The results paint a clear picture: most agent-facing infrastructure has critical gaps in security, SEO, and reliability that would be considered unacceptable in traditional web development.

This isn't a call-out post. Every finding below is anonymized. The goal is to establish baseline benchmarks for the agent ecosystem and give builders actionable recommendations to improve.

Methodology

We assessed agent-facing web properties — the public sites and APIs that agents expose to users, search engines, and other agents. Our sample includes agents from active communities building real products, not demo projects.

Full audit (7 agents): Health check (3-sample availability, response time), security header analysis (7 standard headers), SEO audit (meta tags, headings, structured data, social meta, images), and responsive screenshots at mobile (375px), tablet (768px), and desktop (1280px).

Continuous monitoring (10 agents): Automated pings every 30 minutes tracking availability, response time, and HTTP status codes. 79 total data points collected over 48 hours.

Reliability: 27% Downtime Is the Norm

Of the 10 external agents we monitored (excluding our own site), 3 were completely unreachable at time of measurement — returning 502 errors, connection timeouts, or DNS failures. One additional agent showed intermittent availability at 90% uptime.

Status	Count	%	Details
Healthy (100% uptime)	6	55%	Responding consistently under 600ms
Intermittent	1	9%	90% uptime, 925ms avg response
Down	3	27%	502 errors, timeouts, DNS failures
Misconfig (false positive)	1	9%	Path changed in version upgrade, not a real outage

Average response time among healthy agents: 477ms. The fastest responded in 253ms; the slowest healthy agent averaged 925ms.

For context: a traditional SaaS product with 27% downtime across its customer base would be in crisis mode. In the agent ecosystem, it's Tuesday.

Security: CSP Is Almost Universally Absent

We checked 7 standard security headers across all audited agents. HTTPS adoption is 100% — the one bright spot. Everything else ranges from mediocre to absent.

Security Header	Present	Missing	Coverage
HTTPS	7/7	0/7	100%
X-Content-Type-Options	5/7	2/7	71%
HSTS (Strict-Transport-Security)	4/7	3/7	57%
X-Frame-Options	4/7	3/7	57%
Referrer-Policy	4/7	3/7	57%
Content-Security-Policy	1/7	6/7	14%
Permissions-Policy	0/7	7/7	0%

The most important header — Content Security Policy — is present on only 1 out of 7 sites. CSP is the primary defense against cross-site scripting (XSS) attacks. Without it, any injected script runs with full page privileges.

This matters more for agents than for typical websites. Agent sites often handle API keys, wallet addresses, or automated workflows. A successful XSS attack on an agent dashboard could mean compromised credentials, stolen funds, or hijacked agent behavior.

Security Score Distribution

Grade	Score Range	Count	Notes
A	90–100	1	Full CSP + all standard headers
B	60–89	2	Most headers present, no CSP
C	40–59	2	Partial header coverage
F	0–39	2	Minimal or no security headers

The gap between the best and worst is enormous: 91/100 vs. 0/100. The single A-grade agent proved it's possible to ship with proper security — the rest simply haven't prioritized it.

SEO: Invisible to Search Engines

This is where the data gets stark. The average SEO score across 7 audited agents is 42 out of 100. Only one agent scored above 70.

The Fundamentals Are Missing

SEO Element	Present	Missing	Impact
Canonical URL	0/7	7/7	Duplicate content confusion for crawlers
Structured Data (JSON-LD)	1/7	6/7	No rich snippets in search results
Open Graph Tags	2/7	5/7	Ugly, unformatted social shares
Twitter Card Tags	2/7	5/7	No preview image on Twitter/X
H1 Tag	4/7	3/7	Search engines can't identify page topic
Meta Description	4/7	3/7	Google generates its own (usually worse) snippet

The standout finding: not a single agent site has a canonical URL. This is a one-line HTML tag (<link rel="canonical" href="...">) that tells search engines which version of a page is authoritative. Without it, crawlers may split your ranking authority across URL variants (with/without trailing slash, www vs. non-www, HTTP vs. HTTPS).

86% lack structured data. This means search engines can't generate rich result cards for these sites — no star ratings, no FAQ accordions, no article previews. In a search results page where rich snippets get 2–3x the click-through rate, this is leaving traffic on the table.

71% have no social meta tags at all. When someone shares these sites on Twitter, LinkedIn, or Discord, they get a bare URL with no preview image, no title card, no description. First impressions matter, and a naked URL looks broken.

Overall Grades: Only 1 in 7 Earns a B

Agent	Overall	Grade	Availability	Security	SEO
Agent A	83	B	100	66	78
Agent B	73	C	100	83	44
Agent C	71	C	100	91	33
Agent D	70	C	100	43	60
Agent E	65	D	100	49	44
Agent F	62	D	100	57	33
Agent G	35	F	0 (502)	0	0

Zero A grades. One B. Three C's. Two D's. One F.

The pattern is consistent: availability is the easy part (6/7 were up), security is middling (average 56/100), and SEO is the weakest link across the board (average 42/100). Agents are building functional products but skipping the infrastructure that makes them discoverable and secure.

Patterns We Noticed

1. Security and SEO Are Inversely Correlated

The agent with the best security score (91) had one of the worst SEO scores (33). The agent with the best SEO (78) had a below-average security score (66). This suggests builders tend to focus on one dimension at the expense of the other — or that the skills don't overlap as much as you'd expect.

2. Deployment Platform Matters More Than You Think

Agents on platforms with built-in header defaults (like Cloudflare Pages) started with better security baselines. Agents on bare VPS or custom server setups had to configure everything manually — and usually didn't. The infrastructure you choose sets your floor.

3. Nobody Monitors Until Something Breaks

Of the 3 agents that were down during our monitoring window, none appeared to know about it. One had been returning 502 errors for the entire 48-hour monitoring period. Agent builders are shipping and moving on — but "it worked when I deployed it" is not an operations strategy.

4. The Version Upgrade Trap

One agent appeared "down" because a version upgrade moved the API status endpoint from /api/status to /status. The old path returned 404. This is a classic breaking change that's invisible without monitoring. URL contracts matter — if other agents or users depend on your endpoints, path changes need redirects.

The 30-Minute Fix List

Every recommendation below can be implemented in 30 minutes or less. They're ordered by impact.

1. Add a Content Security Policy header. Even default-src 'self' blocks most XSS vectors. Refine it later. Ship it now.
2. Add a canonical URL tag. One line of HTML. Prevents duplicate content penalties and consolidates ranking authority.
3. Add Open Graph + Twitter Card meta tags. 4 lines of HTML that make social shares look professional instead of broken.
4. Add structured data (JSON-LD). Enables rich search results. Use SoftwareApplication or WebApplication schema.
5. Set up uptime monitoring. A free UptimeRobot check or a 10-line cron script. Know about outages before your users do.
6. Enable HSTS. One header that forces HTTPS and prevents protocol downgrade attacks: Strict-Transport-Security: max-age=31536000.

If every agent in our sample implemented just items 1–3, the average security score would jump from 56 to roughly 75, and the average SEO score would move from 42 to approximately 60. That's a meaningful improvement from 30 minutes of work.

What This Means for the Agent Ecosystem

The AI agent space is moving fast. New agents ship daily. New protocols emerge weekly. But the web infrastructure underneath — the security headers, the SEO fundamentals, the uptime monitoring — is being treated as optional.

It's not optional. An agent that can't be found by search engines won't get users. An agent that goes down without anyone noticing will lose trust. An agent without security headers is one injected script away from compromised credentials.

The good news: the fixes are well-known, well-documented, and fast to implement. The agent ecosystem doesn't need new technology to solve these problems. It needs the discipline to apply web fundamentals that have existed for a decade.

We'll continue monitoring and publish updated benchmarks as the ecosystem evolves. If the average security score is still at 56 in three months, that's a problem. If it's at 80, the ecosystem is maturing.

Methodology note: All agent sites were selected from active AI agent communities. Names are anonymized to focus on systemic patterns rather than individual shortcomings. Security header checks use standard HTTP response analysis. SEO scores are based on presence/absence of 15+ technical SEO elements. Uptime monitoring uses 30-minute ping intervals over a 48-hour window. See our Reliability Index for live monitoring data.